Where
-Infinity
0

Trending

Last week
Last month
Last year

Vendor Risk Score

See how wpforms compares to other vendors in security performance

View Risk Score →

I was reporter #11 for a WPForms PayPal webhook vulnerability (CVE-2026-4986)

First published (updated )
Social
reddit

WPForms WPForms – Easy Form Builder for WordPress – Contact Forms, Payment Forms, Surveys, & MoreWPForms <= 1.10.2 - Improper Neutralization of CRLF Sequences to Unauthenticated Email Header Injection via Reply-To Display Name

Risk 27
Severity
5.3
First published (updated )
CVE-2026-12127

WPForms Contact Form by WPFormsWordPress Contact Form by WPForms plugin <= 1.10.0.4 - Broken Access Control vulnerability

Risk 43
Severity
7.5
First published (updated )
CVE-2026-48835

WPForms WPFormsWPForms <= 1.10.0.4 - Unauthenticated Insufficient Verification of Data Authenticity via PayPal Commerce Webhook Endpoint

Risk 27
Severity
5.3
First published (updated )
CVE-2026-7792

WPForms Contact Form by WPFormsWordPress Contact Form by WPForms plugin <= 1.9.8.7 - Sensitive Data Exposure vulnerability

Risk 37
Severity
6.5
First published (updated )
CVE-2026-25339
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WPForms Contact Form by WPFormsWordPress Contact Form by WPForms plugin <= 1.9.9.3 - Broken Access Control vulnerability

Risk 16
Severity
4.3
EPSS
0.03%
First published (updated )
CVE-2026-32446

WPForms WPFormsWPForms 1.7.8 - Cross-Site Scripting (XSS)

Risk 38
Severity
5.1
First published (updated )
CVE-2020-36919

Tablesome Contact Form DBTablesome Table – Contact Form DB – WPForms, CF7, Gravity, Forminator, Fluent <= 1.1.32 - Unauthenticated Arbitrary File Upload

Risk 86
Severity
9.8
First published (updated )
CVE-2025-11499

WPForms Embed PDF for WPFormsEmbed PDF for WPForms <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Upload

Risk 79
Severity
8.8
First published (updated )
CVE-2025-10647

WPForms Easy Form Builder for WordPressWPForms Lite <= 1.9.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'start_timestamp' Parameter

Risk 35
Severity
5.4
First published (updated )
CVE-2025-3794
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

PirateForms Contact Form & SMTP Plugin for WordPressContact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS

Risk 38
Severity
6.1
First published (updated )
CVE-2024-11273

PirateForms Contact Form & SMTP Plugin for WordPressContact Form & SMTP Plugin for WordPress by PirateForms < 2.6.0 - Admin+ Stored XSS

Risk 38
Severity
6.1
First published (updated )
CVE-2024-11272

WPForms WPFormsWPForms Lite <= 1.9.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via fieldHTML Parameter

Risk 39
Severity
6.4
First published (updated )
CVE-2024-13403

WPForms PDF for WPForms + Drag and Drop Template BuilderPDF for WPForms + Drag and Drop Template Builder <= 4.6.0 - Authenticated (Contributor+) Stored Cross-Site Scripting via yeepdf_dotab Shortcode

Risk 39
Severity
6.4
First published (updated )
CVE-2024-12593

WPForms Contact FormWordPress WPForms Lite plugin <= 1.9.2.2 - Broken Access Control vulnerability

Risk 79
Severity
8.8
First published (updated )
CVE-2024-56276
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WPForms WPFormsWPForms < 1.9.2.3 - Admin+ Stored XSS

Risk 36
Severity
4.7
First published (updated )
CVE-2024-11223

WPForms WPFormsWPForms 1.8.4 - 1.9.2.1 - Missing Authorization to Authenticated (Subscriber+) Payment Refund and Subscription Cancellation

Risk 58
Severity
8.5
First published (updated )
CVE-2024-11205

WPForms WPFormsWPForms < 1.9.1.6 - Admin+ Stored XSS

Risk 24
Severity
3.5
First published (updated )
CVE-2024-7056

WPForms WPFormsWPForms – Easy Form Builder for WordPress <= 1.9.1.6 - Cross-Site Request Forgery (CSRF) to Plugin's Log Deletion

Risk 22
Severity
4.3
First published (updated )
CVE-2024-10593

WPForms File Upload Types by WPFormsFile Upload Types by WPForms <= 1.4.0 - Authenticated (Author+) Stored Cross-Site Scripting via SVG File Upload

Risk 39
Severity
6.4
First published (updated )
CVE-2024-10016
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WPForms PDF Builder for WPFormsPDF Builder for WPForms <= 1.2.116 - Unauthenticated Full Path Disclosure

Risk 19
Severity
5.3
EPSS
0.05%
First published (updated )
CVE-2024-7414

WPForms User RegistrationWordPress WPForms User Registration plugin <= 2.1.0 - Authenticated Privilege Escalation vulnerability

Risk 71
Severity
8
First published (updated )
CVE-2023-52209

Incsub Forminator WordpressSQL Injection

Risk 49
Severity
7.2
EPSS
0.04%
First published (updated )
CVE-2024-31077

WPForms Wpforms WordpressXSS

Risk 31
Severity
7.2
EPSS
0.04%
First published (updated )
CVE-2023-7063

WPForms Wp Mail Smtp WordpressWP Mail SMTP Pro <= 3.8.0 - Missing Authorization to Information Dislcosure via is_print_page

Risk 27
Severity
5.3
First published (updated )
CVE-2023-3213
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

WPForms Contact Form WordpressWordPress WPForms plugins - Reflected Cross Site Scripting (XSS) vulnerability

Risk 38
Severity
6.1
First published (updated )
CVE-2023-30500

WPForms Contact Form WordpressContact Form & SMTP Plugin by PirateForms <= 2.5.1 - Unauthenticated HTML injection

Risk 44
Severity
7.2
First published (updated )
CVE-2019-25145

WPForms WPForms Pro WordPressWPForms Pro < 1.7.7 - CSV Injection

Risk 86
Severity
9.8
First published (updated )
CVE-2022-3574

WPForms Contact Form WordpressXSS

Risk 34
Severity
5.4
First published (updated )
CVE-2020-10385

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203